Email Service Supports Unencrypted Authentication

[jshapiro2]

I have now run security scans on multiple versions of POSTAL including version 3.3.4. I have done all changes to Caddyfile and postal.yml postal to enforce this. Need postal to stop passing back "PLAIN".

Here is the issue
SMTP Unencrypted Cleartext Login
CVSS Rating 4.8 (v2)

The remote SMTP server accepts logins via the following cleartext authentication mechanisms over unencrypted connections:

PLAIN
LOGIN

The remote SMTP server supports the 'STARTTLS' command but isn't enforcing the use of it for the cleartext authentication mechanisms.

[willpower232]

Unfortunately I don't believe you can turn that off currently but there is nothing stopping you from changing your own version of Postal.

You could remove this line

postal/app/lib/smtp_server/client.rb

Line 98 in da90e75

when /^AUTH PLAIN/i then auth_plain(data)

and edit this line

postal/app/lib/smtp_server/client.rb

Line 159 in da90e75

"250 AUTH CRAM-MD5 PLAIN LOGIN",